Ivan Okhotnikov d3a5bf745f docs(oidc): clarify — chart requests email scope explicitly (not a realm-default) ...

Adversarial review flag: the previous rewording implied the cozy realm
has `email` in its client-scope defaults, which is misleading — the
per-cluster client my chart creates lists only `groups` and the
per-cluster audience scope as defaults. The `email` claim reaches the
token because the chart-generated `kubectl oidc-login` block passes
`--oidc-extra-scope=email` explicitly, not because of realm-side
default-scope hygiene.

State the actual mechanic: `email` is a built-in OIDC scope available
in every conformant issuer, requested by the client at auth time via
the kubeconfig's exec block. No realm-side configuration required.
For `CustomConfig`, note that the operator should verify their BYO
issuer emits `email` when the client requests the `email` scope
(every conformant provider does).

Signed-off-by: Ivan Okhotnikov <ivan.okhotnikov@aenix.io>

2026-07-06 09:25:07 +03:00

..

agents

ci: address CodeRabbit review on build-matrix workflow

2026-06-25 17:51:38 +05:00

changelogs

docs(release): add changelog for v1.4.5 (#3083)

2026-07-03 17:50:16 +05:00

operations

feat(platform): add default backupclass

2026-05-28 13:49:59 +04:00

gpu-vgpu.md

docs(gpu-operator): document passthrough variant host-driver prerequisite

2026-06-10 02:12:05 +03:00

hubble-observability.md

docs: add Hubble network observability documentation and dashboards

2026-01-02 04:17:56 +08:00

oidc-tenant.md

docs(oidc): clarify — chart requests email scope explicitly (not a realm-default)

2026-07-06 09:25:07 +03:00

release.md

docs(release): document automated patch-release cron and support window

2026-06-21 14:26:15 +03:00

storage-immutability.md

build(dashboard): pin console image builder to pnpm 11.1.2 and repoint vendor doc link

2026-06-26 20:00:12 +05:00